Deploy via MDM (macOS)

Rolling the macOS Flowstate Agent out to a fleet is two steps:

1. Deploy the app — push the signed FlowstateAgent.pkg to your Macs.
2. Deploy the profile — download the ready-made .mobileconfig from Settings → AI → Cloud Proxy in the Flowstate web app, replace the $EMAIL placeholder with your MDM's user-email variable, and push it to the same Macs.

That's the whole deployment. The downloaded profile already contains everything the agent needs: its configuration, the system-extension approval, and the background-item allow-list. There is no separate "approve the extension" step, no hand-built payloads, and no Privacy (PPPC/TCC) profile to create.

This guide covers Kandji, Mosyle, Microsoft Intune, Jamf Pro, and Apple Business Manager (ABM). For a single Mac, see Install on macOS.

Before you start

Collect two things:

• The app package. Each release publishes an immutable, per-version package at https://binaries.flowstate.inc/macos/beta/FlowstateAgent-VERSION.pkg, with its SHA-256 hash published alongside. The URL never changes once published, so you can reference it directly from your MDM.
• The profile. In Flowstate, open Settings → AI → Cloud Proxy on your tenant and click Generate MDM profile. This downloads a ready-to-upload .mobileconfig with your org token already embedded and UserEmail set to the $EMAIL placeholder.

1. Deploy the app package

The package is the same everywhere; only the delivery mechanism differs.

MDM	How to deploy
Kandji	Add a Custom App library item, set Install Type to Installer package (PKG/DMG), and either upload the pkg or point it at the binaries.flowstate.inc URL. Scope to your Mac blueprint.
Mosyle	Management → macOS Apps → Custom PKG. Upload FlowstateAgent.pkg (or reference the URL) and assign it to the device group.
Intune	Apps → macOS → Add → macOS app (PKG). Upload the pkg, set detection to the bundle id inc.flowstate.agent, and assign it as Required.
Jamf Pro	Upload the pkg to a distribution point and add it to a policy scoped to your Macs.
ABM	Distribute the package as a hosted app — see the callout below.

Apple Business Manager — hosted package entry

ABM hosts and assigns the package; it does not push configuration profiles (your MDM does that, in step 2). When adding the hosted package in ABM, use these exact field values:

Field	Value
macOS Package URL	https://binaries.flowstate.inc/macos/beta/FlowstateAgent-VERSION.pkg
SHA-256 Hash	the hash published with the release
Bundle ID	inc.flowstate.agent
Version	the release tag, e.g. 2.8.0

Assign the package to your device group, then use your MDM for step 2.

2. Deploy the profile

Download the .mobileconfig from Settings → AI → Cloud Proxy, then:

1. Replace the $EMAIL placeholder with your MDM's user-email variable (see the table below).
2. Upload it as a custom configuration profile and scope it to the same Macs that get the package.

That single profile approves the system extension, allows the agent's background item, and delivers its configuration — all without prompting the user.

Replace the $EMAIL variable — do not skip this

The profile leaves UserEmail as the literal string $EMAIL so that each device authenticates as its own enrolled user. Every MDM expands a per-device variable to the assigned user's email, but each uses a different token. Replace the literal $EMAIL in the profile with your MDM's token before you upload:

MDM	Variable to use	Notes
Kandji	$EMAIL	Already used by the generated profile — no change needed.
Jamf Pro	$EMAIL	Payload variable, upper-case, resolved from the computer record's User and Location → Email Address.
Mosyle	%Email%	Replace $EMAIL → %Email%.
Intune		Curly braces, case-sensitive. Replace $EMAIL → ; use if the mail attribute differs from the UPN.

The email must resolve per device

These variables only expand when the device has an assigned user in the MDM (Jamf's User and Location, Intune's primary user, etc.). On a device with no assigned user the token stays literal and the agent has no identity to attribute to. Confirm your enrolment assigns users before rollout.

Building your own profile

The downloaded profile is all most fleets need. If you must hand-build one, its managed-preferences payload targets the inc.flowstate.agent domain with the keys below — see environment variables for the full set and defaults.

Key	Value
Tenant	your tenant host, e.g. acme.flowstate.inc
ProxyUrl	https://proxy.flowstate.inc
UserEmail	$EMAIL (your MDM's per-device variable)
UserToken	your org token
HiddenMode	true to hide the menubar icon (optional)
UserCannotDisable	true for always-on lockdown (optional)

A hand-built profile must also include the system-extension approval and background-item allow-list that the generated profile bundles for you.

Verify

On a test device that has received the profile and the package:

1. Extension loaded — run systemextensionsctl list and confirm inc.flowstate.agent.netproxy shows [activated enabled].
2. Proxy active — the Flowstate menubar shows Capture: running, and System Settings → Network shows the Flowstate transparent proxy.
3. Traffic reaching the proxy — use Claude, ChatGPT, Cursor, or an AI CLI, then confirm outbound connections to proxy.flowstate.inc (e.g. with nettop or Console).
4. Telemetry in Flowstate — sessions appear under Settings → AI → Cloud Proxy on your tenant within a few minutes, attributed to the device's user.

If anything is missing, work through troubleshooting. Confirm the profile landed under System Settings → General → Device Management, and that the assigned-user email resolved (step 4 above).